The Storm ransomware group has listed WindRose Health Network, an Indiana network of community health centers, on its dark web leak site, claiming to have stolen internal data, according to threat trackers.
Ransomware.live recorded the listing on August 18 with an estimated attack date of August 16, 2026, and tagged the organization under healthcare. GalaxyWarden carried the same claim the same day, flagging it as high severity. Both trackers note the claim is unverified, and WindRose Health Network has not publicly confirmed an intrusion.
WindRose Health Network operates federally qualified health centers in Indiana focused on family medicine, pediatrics, prenatal care, and behavioral health for underserved communities. The trackers also note that Storm is an emerging operation, so the claim should be treated with caution until independently verified. Hudson Rock data tied to the organization’s domain lists four third-party employee credentials in infostealer logs, a common early signal in ransomware intrusions but not proof of the attack itself.
If confirmed, the incident would extend a busy month for Storm, which has claimed multiple healthcare organizations in recent weeks. For safety-net providers, the claim is a reminder that smaller community health centers face the same extortion pressure as large hospital systems, and leak-site mentions should trigger immediate incident response even when unconfirmed.
